The certification process of commercial aircraft and engine programs by the Federal Aviation Administration (FAA) suffers from “undue pressure on line engineers and production staff.” It is often understaffed, expertise is ignored, and at times, the FAA lacks the capability to certify complex aircraft systems. Oversight on Boeing’s Organization Designation Authorization (ODA) program has eroded. These and other findings should result in a complete review of the FAA’s role on oversight and its safety culture, a report by the US Senate Committee of Commerce, Science, and Transportation says. Whistleblower report critical of FAA oversight on Boeing. The "Aviation Safety Whistleblower Report" chaired under Democratic Senator Maria Cantwell was released on December 13. It includes extensive statements from seven whistleblowers who contacted the Committee with their experiences and recommendations of aircraft safety and certification within the FAA. The report is a follow-up of the House Committee investigation into the design and certification of the Boeing MAX after the two fatal crashes in October 2018 and March 2019, in which 346 occupants lost their lives. Already in a September 2020 report, the House Committee criticized FAA oversight on the MAX and other Boeing programs, as “multiple career FAA officials have documented examples where FAA management overruled a determination of the FAA’s own technical experts at the behest of Boeing.” This report and its recommendations resulted in the December 2020 Aircraft Certification, Safety, and Accountability Act, with the aim to improve oversight. Whistleblowers offered insight and advice to the Committee when the legislation was drafted. The latest report, of which various details have been published in past months, discloses with their approval the identity of the seven whistleblowers. It comes with further recommendations. The 97-page report includes numerous accounts from the seven whistleblowers on oversight shortfalls within Boeing and General Electric. Here we summarize a few: 1 – Relentless schedule pressure on FAA certification staff: Ed Pierson, who oversaw production support for the final assembly of the 737 series, wing components, and the U.S. Navy’s P-8 Poseidon aircraft until his retirement in 2018, stepped forward to inform the Committee of quality control problems and schedule pressures within the 737/MAX program in Renton. Pierson observed “a huge rolling logjam of unfinished airplanes,” “a shortage of skilled union employees (electricians, mechanics, technicians & quality inspectors)”; “an unusually high number of quality defects and functional test failures”; “an overworked workforce”; and “an increase in high hazard worker safety near misses.” According to Pierson, between the two fatal MAX crashes, there were another eleven safety incidents involving the MAX, or thirteen in total. “Thus two safety incidents per month. So at a time when Boeing and the FAA should have been operating at an extremely heightened sense of awareness after the Lion Air crash, the MAX continued to average two safety incidents per month for the five months leading up to the Ethiopian Airlines crash.” Roll out of the first Boeing 787-8 in 2007. The program suffered numerous quality issues and continues to do so. (Boeing) Martin Bickeboeller, who served on the Boeing 787 program as the technical fellow for configuration management in close relationships with suppliers, notes that the same scheduling pressure has impacted quality within the 787 supply chain. His remarks cover the 2008-2011 period, so the start of the Dreamliner program, when he observed quality problems with supplies from Mitsubishi, Alenia (now Leonardo), and Global Aeronautica (now Boeing South Carolina). He cited a lack of oversight within Boeing on the quality of the outsourced parts, which include the composite wings. After complaining, Bickeboeller was removed from his position as a senior technical specialist on the 787 program. According to Bickeboeller, the same culture is still evident at Boeing, as the recent quality issues of the Dreamliner confirm: “The culture of regarding procedural violations as an issue to be dealt with when it is convenient is endemic at Boeing and within its executive management….” He also stated: “Boeing’s culture of dealing with issues Boeing perceives [to be] “only a violation of regulations” but “probably not a direct product safety issue” is a dangerous culture not conducive to the proper safety of aerospace products.” Undue pressure was also experienced by Richard Kucera, a long-time engineer with GE Aviation and responsible for supporting the issuance of product certification. He also led ODA within GE and, as such, saw himself in a difficult position of checking if the GE9X for the Boeing 777X complied with FAA standards in both roles as GE engineer and ODA leader. When Kucera identified twenty to thirty discrepancies and informed his supervisor, he was threatened with termination for “having potentially jeopardized the schedule of GE’s product certification (the GE9X) in the performance of my duties representing the FAA.” He was placed on a coaching plan to address his performance. The report also mentions an FAA survey among staff with its Boeing ODA office, in which 35 percent of the respondents voiced concerns over undue influence. “Consistent with ongoing concerns of whistleblowers who have been in contact with the Committee, FAA found that Boeing’s “company culture appears to hamper members of the ODA unit from communicating openly with the FAA.” 2 – Line engineers with expertise not listened to: The Committee report then includes a number of examples where line engineers flagged certain quality issues but were neglected. One is from Curtiss Ewbank, who after the 2018 Lion Air MAX crash has been whistleblowing his concerns about what he as a flight crew operations integration engineer witnessed on the MAX program. Ewbank stated that Boeing management, including then-CEO Dennis Muilenburg, was well-aware of the flaw that the Maneuvering Characteristics Augmentation System (MCAS) relied on input from just a single angle-of-attack sensor. He also told the Committee that Boeing had withheld information to the European regulatory agency EASA on numerous autothrottle incidents with the MAX: “Following a discussion with my manager and second-level manager…the decision was made to not tell EASA about these events, as they had not come through the Continued Operational Safety Program process, and that we would fix the issue ourselves.” Ewbank left Boeing in 2015 “in protest of management actions to rationalize the poor design of the 737 MAX.” More engineers were sidelined, including Michael Collins, who as an FAA engineer was also involved with the MAX program. He stated that the FAA ignored concerns raised by thirteen engineers, four managers, and one pilot “regarding the method of compliance FAA used to evaluate the 737 MAX’s rudder control design. He also highlighted a safety-critical problem with a fuel pump on the 737 MAX—the pump had an electrical circuit protection problem—which FAA certified over the recommendation of an FAA engineer.” Technicians and engineers who made critical remarks were sidelined, the report says. (Boeing) This incident was preceded a few years earlier by another one involving the safety of the original design of the lithium-ion battery on the 787, which lacked a fire-proof enclosure: “FAA managers pushed to delegate 95 percent of the 787 Dreamliner’s certification to Boeing. This delegation decision included the certification of new high-risk battery installation technology, a decision made against the recommendation of a technical specialist who identified the system’s safety-critical design flaw.” Collins pointed out that the concerns that were voiced later led to the battery fires that grounded the Dreamliner in 2013. According to Collins, the safety culture and the FAA’s oversight within Boeing began to change in 2001 after the fatal fuel tank explosion of the TWA Boeing 747: “Prior to the ODA system being implemented, FAA certificated the highly successful 757, 767, 777, and 747-400 with fewer FAA engineers who conducted direct oversight of company designees. However, more recently the FAA management safety culture often seems more interested in allowing applicants to produce designs that do not comply with the minimum safety standards defined by the FARs.” The report also highlights short-staffing of the FAAs Boeing Aviation Safety Oversight Office (BASOO) within Boeing ODA, which the Committee refers to as “arguably the most complex ODA organization in the country.” The ODA unit includes some 1.500 Boeing representatives or unit members, but in late October, the FAA had only 53 employees working at Boeing, including 31 engineers and technical project managers. This is partly to blame on budget shortfalls within the agency, but the effect has been that the FAA lacked sufficient experience and knowledge (including a human factors specialist) on the MAX certification program. As FAA Engineer Mike Dostert remarked: “The current [ODA] system is based upon the assumption that the organization within the company can effectively operate as an independent branch within the company that will force the company to comply with regulations. The ODA selects Authorized Representatives (ARs), determines proficiency/competency, regardless of turnover in the organization and organizational pressures within the company to meet certification schedules. In addition, the Boeing ODA has a group review of specific issues that has resulted in many ARs not wanting to speak up due to a “group think” phenomenon. The fundamental assumptions that form the basis of the ODA are flawed. . . . [T]he current system puts barriers to open communication with the FAA. In fact, Boeing has an internal requirement that ARs must obtain permission to contact the FAA. . . . Boeing has demonstrated their ODA is not forcing the company to produce a compliant design.” 3 – Aircraft designs don’t meet the most recent airworthiness criteria: The result has been, as Ewbank and Collins highlighted, that the FAA has certified Boeing airliners that haven’t met the most recent airworthiness criteria, notably the MAX with MCAS. This system wasn’t analyzed properly by the FAA “due to the means of compliance granted to Boeing for its amended type certificate”, said Ewbank. By flagging MCAS as a non-significant modification, Boeing came away from requesting approval under the Changed Product Rule. Ewbank adds: “This lack of analysis reduces the overall safety of the 737 MAX as compared to a newly developed airframe. And this use of the changed product rule to avoid scrutiny on unchanged systems is enormously important to the future of aviation safety – the changed/unchanged system line on the 777X is even more convoluted and involves more complicated systems than the 737 MAX.” The 787 too was certified without complying to the airworthiness standards for lithium-ion batteries. The complexity of systems and the relationship between human factors and automation also poses challenges for the FAA. BASOO acting manager Ian Won identified the complexity of the Common Core System on the Boeing 777X as an example of a system that needs better understanding before the aircraft can be certified. As a result, the FAA told Boeing earlier this year that it isn't ready for starting Type Inspection Authorization (TIA) of the 777X. It’s been probably the first visible example of the effect that criticism has had on the FAA and Boeing. The recommendations: The Senate Committee concludes its reports with a number of recommendations, although at the same time it notes that some should already have been executed since the Aircraft Certification, Safety, and Accountability Act passed in December 2020. The recommendations to the FAA are: A – Strengthen direct ODA oversight, by assigning more unit members and safety advisors, effective from January 1, 2022. Not only with Boeing but also GE Aviation and Pratt & Whitney. B - Address undue pressure at Boeing ODA and report to Congress on any corrective action. C – Ensure sufficient technical and engineering capacity for safety oversight. D – Review and verify all human factors assumptions before delegating certification tasks related to safety-critical design features. E - Require that manufacturers adopt formal safety management systems and implement root cause analysis followed by corrective action. F - Ensure integrated aircraft safety analysis that considers the cumulative effects of proposed design changes to the aircraft, human factors issues, and impacts on training for pilots and maintenance personnel. G – Complete an annual safety culture survey. H - Build greater accountability into the aircraft design process to ensure compliance with airworthiness standards and immediate corrective action for non-compliant designs. I - Strengthen oversight over the production process to address scheduling pressures and problems in the supply chain. J - Build up its technical capacity and capability to effectively evaluate and certify increasingly complex flight systems technology. The eleventh recommendation is addressed to Congress: K - Congress should consider programs to address staffing shortages in aerospace to prevent the loss of engineering experience and knowledge necessary to develop complex and innovative aircraft systems. Except for the first, the report doesn’t specify a roadmap or time schedule as to when all these recommendations will have to be addressed. Despite a brain drain that is mentioned numerous times, getting adequate staffing might seem the easiest problem to tackle. What will not change overnight is changing a deep-rooted culture that has been with Boeing for at least two decades and has been evident at GE Aviation as well. This might take years and require a new generation of engineers and technicians with different ethical standards to enter the industry.
